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DETAILED ACTION 

Response to Arguments 

1 . Applicant's arguments, see page 1 1 , filed 3/1 9/2008, with respect to double 
patenting have been fully considered and are persuasive. The rejection of claims 1—14 
under double patenting has been withdrawn. 

2. Applicant's arguments filed 3/1 9/2007, see pages 12-15, with respect to 
rejections made under 35 USC 103, have been fully considered but they are not 
persuasive. 

3. Applicant argues, relating to the Sorhaug reference, that Sorhaug fails to teach 
means for inserting device data "without disrupting the flow of data in the network 
cable". Applicant notes that Sorhaug states that 

"the medium monitor may interrupt medium data transfer in either direction and 
insert its data for diagnostic or other network purposes" 

(Abstract, emphasis added) 
and that Sorhaug states that 

"the network monitor or medium analyzer can selectively insert data in either 
direction to provide complete diagnostic control testing of the channel." 

(col. 2 lines 12 -14) 

4. However, in the Abstract, Sorhaug merely states that the monitor may interrupt 
data transfer, not that it must interrupt data transfer to insert data. Furthermore, in col. 2, 
lines 12-14, Sorhaug further discusses inserting data without discussing any data 
disruption. Thus, given that there are inherently only two options for data insertions 
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(disruptively or non-disruptively), since Sorhaug discloses both options, it would have 
been obvious to one of ordinary skill in the art at the time of the invention to insert data 
and not disrupt the data flow. 

5. Applicant also argues that Yanacek does not teach "enabling or disabling the 
ability of the first tap port and second tap port to receive network data and device data." 
However, Yanacek clearly teaches turning the tap on and off (Fig. 2, col. 1 lines 1-10, 
col. 4 lines 5-10, lines 50 - 55 and col. 5 lines 53 - 56). Turning said tap off, and 
preventing it from tapping and thus receiving data includes both network and device 
data, where said device data is data sent between the two tapped devices. 

6. Applicant next argues relating to Yanacek's teaching of directional and bi- 
directional data tapping, specifically regarding whether or not said data is device data. 
Regarding Applicant's arguments regarding what qualifies as network data and what 
qualifies as device data, Applicant is reminded that although the claims are interpreted 
in light of the specification, limitations from the specification are not read into the claims. 
See In re Van Geuns, 988 F.2d 1 181 , 26 USPQ2d 1057 (Fed. Cir. 1993). 

Claim Rejections - 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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8. Claims 1 - 13, 15, 16,17,19-24, 26, 27, 29, 30 and 31 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Worrall et al. (US 2006/0153177 A1), 
hereafter Worrall, in view of in view of Sorhaug et al. (US 6,424,627 B1 ), hereafter 
Sorhaug, further in view of Yanacek et al. (5,940,376), hereafter Yanacek. 

9. Regarding claim 1 , Worrall shows a network tap that permits an attached device 
to communicate with a node of a network, the node of the network communicating with 
a network cable transmitting network data thereon, the network cable having a first 
segment and a second segment, the network tap comprising: a first and second tap 
port, at least one of which is configured to receive a copy of network data obtained from 
the network cable, wherein the attached device can be selectively connected to at least 
one of the first and second tap ports (Abstract, Figs. 1A-1C, Figs 4 and 5, [0023-0029]). 

Worrall does not show at least one of the first and second tap ports configured to 
receive device data from the attached device, the first and second tap ports being 
capable of operating in a plurality of modes, each being defined by enabling or disabling 
the ability of the first and second tap ports to receive network data and device data; 
means for inserting device data from the attached device into the network cable without 
disrupting the flow of data therein; and means for selecting one of the plurality of modes 
in which the first and second tap ports may operate. 

Sorhaug shows at least one of the first and second tap ports configured to 
receive device data from the attached device, means for inserting device data from the 
attached device into the network cable without disrupting the flow of data therein. 
(Sorhaug, col. 2 lines 1 - 22, col. 2 lines 40 - 65, col. 3 lines 10 - 45). 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worrall with that of Sorhaug in order to allow for 
more control of the network tap apparatus, and how the data in said network tap system 
was handled in order to enable more options for configuration and use as well as to 
monitor data at maximum data rates while providing not significant network data delay 
(Sorhaug, Abstract, col. 1 line 40 - col. 2 line 10). 

Worrall in view of Sorhag do not show the first and second tap ports being 
capable of operating in a plurality of modes, each being defined by enabling or disabling 
the ability of the first and second tap ports to receive network data and device data; and 
means for selecting one of the plurality of modes in which the first and second tap ports 
may operate. 

Yanacek shows the first and second tap ports being capable of operating in a 
plurality of modes, each being defined by enabling or disabling the ability of the first and 
second tap ports to receive network data and device data; and means for selecting one 
of the plurality of modes in which the first and second tap ports may operate (Fig. 2, col. 
1 lines 1 - 1 0, col. 4 lines 5-10, lines 50 - 55 and col. 5 lines 53 - 56). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worrall in view of Sorhaug and NetOptics with that 
of Yanacek in order to enable and more advanced and flexible system. 
1 0. Regarding claim 2, Worrall in view of Sorhag and Yanacek further show wherein 
in one mode, the first and second tap ports are both enabled to receive the network 
data (Worrall, Figs. 1a-1c, 3a-3c; Sorhag, Fig. 2 and col. 2 lines 5-65). 
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1 1 . Regarding claim 3, Worrall in view of Sorhag and Yanacek further show wherein 
in one mode, at least one of the first and second tap ports are enabled to receive device 
data (Worrall, Figs. 1a-1c, 3a-3c; Sorhag, Fig. 2 and col. 2 lines 5-65). 

12. Regarding claims 4 - 9, Worrall in view of Sorhag and Yanacek further show 
wherein the first and second tap ports are capable of operating in a plurality of modes, 
each mode being defined by enabling or disabling the ability of the first and second tap 
ports to receive data (Yanacek Fig. 2, 10A- 10C), including network and device data 
(Worrall, Figs. 1a-1c, 3a-3c; Sorhag, Fig. 2 and col. 2 lines 5-65). 

Worrall in view of Sorhag and Yanacek thus disclose enabling or disabling the 
ability for each of the tap ports to receive network and device data. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to experiment and try the various permutations of on and off for both network 
and device data, as it is obvious to try choosing from a finite number of identified and 
predictable configurations. 

1 3. Regarding claim 1 0, Worrall in view of Sorhag and Yanacek further show wherein 
means for inserting received device data into the network cable without disrupting the 
flow of data therein comprises an Ethernet switch (Worrall, Fig. 1(c)). 

14. Regarding claim 1 1 , Worrall in view of Sorhag and Yanacek further show wherein 
means for inserting received device data into the network cable without disrupting the 
flow of data therein comprises an integrated circuit (Sorhaug, col. 2 lines 55 - 56, col. 3 
lines 4 5- 47). 
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1 5. Regarding claim 1 2, Worrall in view of Sorhag and Yanacek further show wherein 
the integrated circuit comprises a field programmable gate array (Worrall, Fig. 4). 

16. Regarding claim 1 3, Worrall in view of Sorhag and Yanacek further show wherein 
means for selecting one of the plurality of modes in which the first and second tap ports 
may operate comprises: a management port configured to selectively connect to a 
remote computer; and an integrated circuit configured to receive management data from 
the management port to at least indirectly enable or disable the ability of the first and 
second tap port to receive at least one of network data and device data (Yanacek, Figs. 
2, 10A-10C). 

1 7. Regarding claim 1 5, Worrall in view of Sorhag and Yanacek further show a 
network tap that permits an attached device to communicate with a node of a network, 
the node of the network communicating with a network cable transmitting network data 
thereon, the network cable having a first segment and a second segment, the network 
tap comprising: 

a first tap port configured to receive a copy of network data obtained from the 
network cable (Worrall, Abstract, Figs. 1A-1C, Figs 4 and 5, [0023-0029]); 

a second tap port configured to receive a copy of network data obtained from the 
network cable, wherein the attached device can be selectively connected to at least one 
of the first tap port and second tap port (Worrall, Abstract, Figs. 1A-1C, Figs 4 and 5, 
[0023-0029]), wherein at least one of the first tap port and second tap port is configured 
to receive device data from the attached device (Sorhaug, Fig. 2, col. 2 lines 5 - 65), 
and wherein the first tap port and second tap port are configured to operate in a plurality 
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of modes, each mode being defined by enabling or disabling the ability of the first tap 
port and second tap port to receive network data and device data (Yanacek, Fig. 2, 
10A-10C); 

a routing node that is in communication with the first tap port and second tap 
port, the routing node being configured to pass network data from the network cable to 
at least one of the first tap port and the second tap port and to pass device data from at 
least one of the first tap port and second tap port to the network cable (Sorhaug, col. 3 
line 10 - col. 4 line 45); and 

an integrated circuit (Sorhaug, col. 2 lines 55-56, col. 31 ines 45-47) configured to 
select the mode in which the first tap port and second tap port operate (Yanacek, Figs. 
2, 10A-10C). 

18. Regarding claims 16,17 and 1 9 - 24, Worrall in view of Sorhag and Yanacek 
further show wherein the first and second tap ports are capable of operating in a 
plurality of modes, each mode being defined by enabling or disabling the ability of the 
first and second tap ports to receive data (Yanacek Fig. 2, 10A- 10C), including 
network and device data (Worrall, Figs. 1a-1c, 3a-3c; Sorhag, Fig. 2 and col. 2 lines 5 - 
65). 

Worrall in view of Sorhag and Yanacek thus disclose enabling or disabling the 
ability for each of the tap ports to receive network and device data. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to experiment and try the various permutations of on and off for both network 
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and device data, as it is obvious to try choosing from a finite number of identified and 
predictable configurations. 

1 9. Regarding claim 26, Worrall in view of Sorhag and Yanacek further show a 
network tap that permits an attached device to communicate with a node of a network, 
the node of the network communicating with a network cable transmitting network data 
thereon, the network tap comprising: a first network port configured to transmit or 
receive network data; a second network port configured to transmit or receive network 
data; a first tap port configured to receive a copy of at least some of the network data 
(Worrall, Abstract, Figs. 1A-1C, Figs 4 and 5, [0023-0029]); 

a second tap port configured to receive a copy of at least some of the network 
data (Worrall, Abstract, Figs. 1 A-1C, Figs 4 and 5, [0023-0029]), 

wherein an attached device can be selectively connected to at least one of the 
first tap port and second tap port (Sorhaug, Fig. 2, col. 2 lines 5 - 65), 

wherein at least one of the first tap port and second tap port is configured to 
receive device data from the attached device (Sorhaug, Fig. 2, col. 2 lines 5 - 65), and 

wherein the first tap port and second tap port are configured to operate in a 
plurality of modes, each mode being defined by enabling or disabling the ability of the 
first tap port and second tap port to receive network data and device data (Yanacek, 
Fig. 2, 10A-10C); and 

a first switch (Worrall, Fig. 1(c)) that is in communication with the first network 
port and the second network port and with the first tap port and second tap port, the 
switch being configured to pass network data between the first network port and the 
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second network port and transmit device data from one of the first tap port and second 
tap port to one of the first network port and second network port (Sorhaug, col. 3 line 10 
- col. 4 line 45). 

20. Regarding claim 27, Worrall in view of Sorhag and Yanacek further show utilizing 
a switch that is in communication with the first network port and the second network port 
and with the first tap port and the second tap port, the switch being configured to 
combined network data from the first network port and second network port and transmit 
the combined network data to one of the first tap port and second tap port (Worrall, 
Abstract, Figs. 1A-1C, Figs 4 and 5, [0023-0029]). 

21 . Regarding claim 29, Worrall in view of Sorhag and Yanacek further show an 
integrated circuit configured to select the mode in which the first tap port and the second 
tap port operate (Sorhaug, col. 2 lines 55-56; col. 3 line 10 -col. 4 line 45) 

22. Regarding claim 30, Worrall in view of Sorhag and Yanacek further show wherein 
the integrated circuit comprises a Field Programmable Gate Array (Worrall, Fig. 4). 

23. Regarding claim 31 , Worrall in view of Sorhag and Yanacek further show a 
management port configured to transmit management data to the integrated circuit, the 
management port being configured to be selectively connected to a remote computer 
(Yanacek, Fig. 2, 10A-10C). 

24. Claim 14 is rejected under 35 U.S.C. 103(a) as being unpatentable in view of 
Worarall in view of Sorhaug and Yanacek as applied to claims 1 and 13 above, further 
in view of Bouthillier et al. (6,092,724), hereafter Bouthillier. 
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Worrall in view of Sorhaug and Yanacek enable configuring a network tap to 
operate in one of a pluarality of modes (Yanacek, Figs. 2, 1 0A - 1 0C). 

Worrall in view of Sorhaug and Yanacek do not show where this mode selection 
is done via one or more manual switches on the network tap. 

Bouthillier shows a manual switch for changing the configuration and operating 
mode of a network device (Abstract, Fig. 1). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worrall in view of Sorhaug and Yanacek with that 
of Bouthillier to enable the use of manual switches to configure the electronic device as 
manual switches are well-understood, easy to operate and reliable. 
25. Claim 18 is rejected under 35 U.S.C. 103(a) as being unpatentable over Worarall 
in view of Sorhaug and Yanacek as applied to claim 15 and 17 above, and further in 
view of Bunker et al. (US 2003/00561 16 A1), hereafter Bunker, further in view of 
Chinnock et al. (5,426,427), hereafter Chinnock. 

Worarall in view of Sorhaug and Yanacek show claims 15 and 17. 

Worarall in view of Sorhaug and Yanacek do not show where the attached device 
is an intrusion detection system; and the device data comprises a kill packet from the 
intrusion detection system, the routing node being configured for transmitting the kill 
packet via the network cable to a firewall. 

Bunker shows an intrusion detection system and where the intrusion detection 
system can block access from particular devices ([0009-0010,0150,0312-0313]). 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worarall in view of Sorhaug and Yanacek with that 
of Bunker as it is a combination of prior art elements according to known methods in 
order to yield predictable results. 

Worarall in view of Sorhaug, Yanacek and Bunker do not show where said 
intrusion detection system utilizes a kill packet. 

Chinnock shows a kill packet (col. 12 lines 1 - 25). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worarall in view of Sorhaug, Yanacek and Bunker 
with that of Chinnock as it is a combination of prior art elements according to known 
methods in order to yield predictable results. 

26. Claim 25 is rejected under 35 U.S.C. 103(a) as being unpatentable over Worarall 
in view of Sorhaug and Yanacek as applied to claim 16 above, and further in view of 
Pontis et al. (US 2004/0007526 A1), hereafter Pontis. 

Worarall in view of Sorhaug and Yanacek show a first multiplexer in 
communication with the first tap port (Yanacek, Fig. 2, 10A-10c); and a second 
multiplexer in communication with the second tap port (Yanacek, Fig. 2, 10A-10C), an 
integrated circuit (Worrall, [0024-0026]), as well as communicating with taps in order to 
configure them (Yanacek, Fig. 2, 10A-10C). 

Worarall in view of Sorhaug and Yanacek do not show where said integrated 
circuit controls the first multiplexer and second multiplexer to select the mode in which 
the first tap port and second tap port operate. 



Application/Control Number: 10/735,417 Page 13 

Art Unit: 2142 

Points shows a Field Programmable Gate Array (FPGA), which is inherently a 
type of integrated circuit, controlling a multiplexer's mode ([0075]), thus showing where 
said integrated circuit controls the first multiplexer and second multiplexer to select the 
mode in which the first tap port and second tap port operate. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worarall in view of Sorhaug and Yanacek with that 
of Pontis as it involves use of known techniques (using integrated circuits to control 
multiplexers) to yield predictable results. 

27. Claim 28 is rejected under 35 U.S.C. 103(a) as being unpatentable over Worarall 
in view of Sorhaug and Yanacek as applied to claim 27 above, and further in view of 
NetOptics (4x1 GigaBit Tap). 

Worarall in view of Sorhaug and Yanacek show tap ports receiving copies of 
network data, and utilizing switches for duplicating combined network data and 
transmitting said duplicated combined data (Worrell; Abstract, Figs. 1A-1C, Figs 4 and 
5, [0023-0029]; Sorhaug, col. 2 lines 1 - 22, col. 2 lines 40 - 65, col. 3 lines 1 0 - 45). 

Worarall in view of Sorhaug and Yanacek do not explicitly show a third and a 
fourth tap port. 

NetOptics shows a third and a forth tap port. (pgs. 1 - 3). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worrell in view of Sorhaung and Yanacek with that 
of NetOptics in order to allow for the connection of more devices, enabling more 
detailed network monitoring as well as more possible monitoring configurations. 
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28. Claims 32 and 33 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Worrall in view of Sorhaung and Yanacek as applied to claim 26 above, further in 
view Tomonaga et al. (5,610,913), hereafter Tomonaga and of Gromov (US 6,975,209 
B2). 

29. Regarding claim 32, Worrall in view of Sorhaung and Yanacek show claim 26. 
Worrall in view of Sorhaung and Yanacek do not show claim 26 further 

comprising a first communication line from the first network port to the first switch and a 
second communication line from the second network port to the first switch, each of the 
first communication line and the second communication line including a fan out buffer 
that propagates the network data to the switch and propagates a copy of the network 
data to the first tap port and second tap port. 

Tomonaga shows where multiple inputs are sent into a switch, and then a 
multiplex/dexmultiplex unti, which comprises a fan out buffer memory (Figs. 46 and 47). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worrall in view of Sorhaug and NetOptics with that 
of Tomonaga in order to increase the number of devices and users that a network can 
accommodate and support (Tomonaga, col. 3 lines 57 - 67). 

Worrall in view of Sorhaung, Yanacek and Tomonaga thus show a first 
communication line from the first network port to the first switch and a second 
communication line from the second network port to the first switch, each of the first 
communication line and the second communication line including a fan out buffer that 
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propagates the network data to the switch and propagates a copy of the network data to 
the first tap port and second tap port. 

Worrall in view of Sorhaung, Yanacek and Tomonaga do not show a relay for 
circumventing the first switch in the event of loss of power at the network tap and a 
transformer. 

Gromov shows a relay for circumventing the first switch in the event of loss of 
power at the network tap and a transformer (col. 7 lines 22 - 26, Figs. 2 - 4). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the disclosure of Worrall in view of Sorhaung, Yanacek and 
Tomonaga with that of Gromov as it is combining prior art elements to yield predictable 
results. 

30. Regarding claim 33, Worrall in view of Sorhaung, Yanacek, Tomonaga and 
Gromov show comprising a third communication line for transmitting device data from 
one of the first tap port and second tap port to the first switch, the third communication 
line including: a transformer (Gromov, Figs. 2 - 4, col. 7 lines 22 - 67); a physical layer 
device (Worrall, [0024-0025], Fig. 4; Sorhaug, Fig. 2, col. 1 line 65 - col. 2 line 5); and a 
multiplexer (Worrall, Fig. 4). 

Conclusion 

31 . THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .136(a). 
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A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to JOHN M. FRINK whose telephone number is (571) 272- 
9686. The examiner can normally be reached on M-F 7:30AM - 5:00PM EST; off 
alternate Fridays. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on (571) 272-3868. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

John Frink 

(571 ) 272 - 9686 

/Andrew Caldwell/ 

Supervisory Patent Examiner, Art Unit 2142 



